EUVD-2026-18088
GHSA-fc4p-p49v-r948
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CI4MS backend
-
DeliveryInject malicious JavaScript in user management field
-
ExploitStored payload executes for all admins
-
ExecutionHijack admin session tokens
-
ImpactEscalate privileges and compromise system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated backend user account required to access CI4MS user management interface (versions before 0.31.0.0). Attacker injects malicious JavaScript via unsanitized input fields. Payload executes automatically when other backend users view the affected administrative page, enabling session hijacking and privilege escalation. |
| Impact | Real-world risk is critically high despite no confirmed active exploitation. The CVSS 9.9 score accurately reflects severity due to: network-based attack vector (AV:N) requiring only authenticated low-privilege access (PR:L), low complexity (AC:L) with no user interaction needed (UI:N) for payload execution, and scope change (S:C) enabling attacks beyond the vulnerable component. While EPSS probability data is unavailable and no public proof-of-concept exists, the technical prerequisites are minimal-any authenticated user can plant persistent JavaScript that auto-executes for privileged victims. The Privilege Escalation tag confirms attackers can leverage stored XSS to steal administrator session tokens or perform actions as high-privileged users, making this a high-priority remediation target for any deployment with multiple user roles. The absence of KEV status and public exploits provides a narrow remediation window before weaponization, particularly given the straightforward nature of stored XSS exploitation in administrative interfaces where impact is maximized. |
| Exploit ScenarioDerived | An authenticated attacker with low-level backend access creates or modifies a user account, injecting JavaScript payload into form fields such as username, display name, or bio that are rendered unsanitized in the administrative user listing page. When a system administrator navigates to the user management interface, the stored payload executes automatically in their browser session, exfiltrating session cookies to attacker-controlled infrastructure and enabling immediate administrative account takeover or execution of privileged operations such as creating backdoor accounts or modifying system configurations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to inject malicious JavaScript that executes automatically when administrators access affected pages, enabling session hijacking and full administrative account takeover. The vulnerability affects all versions prior to 0.31.0.0 with a critical CVSS score of 9.9 due to scope change and high impact across confidentiality, integrity, and availability. EPSS data not available; no public exploit code or active exploitation confirmed at time of analysis, though the technical barrier is low (AC:L, PR:L).
RemediationAI
Upgrade immediately to CI4MS version 0.31.0.0, which contains patches addressing the stored XSS vulnerability in backend user management functionality. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 with corresponding security advisory documentation at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948. Organizations unable to upgrade immediately should implement defense-in-depth measures including restricting backend user creation privileges to trusted administrators only, implementing Content Security Policy headers to mitigate XSS execution, and conducting audits of existing user records for suspicious JavaScript patterns in fields rendered in administrative interfaces. Review application logs for unusual user account modifications or session anomalies that may indicate exploitation attempts prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CI4MS (CodeIgniter 4-based CMS skeleton) is a modular content management framework built on the CodeIgniter 4 PHP framework, featuring role-based access control and themeable architecture for rapid application development. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data in the backend user management module lacks proper output encoding or sanitization before being rendered in HTML contexts. The affected component (cpe:2.3:a:ci4-cms-erp:ci4ms) fails to implement context-appropriate escaping mechanisms-likely missing htmlspecialchars() or equivalent encoding functions in CodeIgniter's view layer-allowing JavaScript payloads to persist in database records and execute in administrators' browsers. The CVSS scope change (S:C) indicates the vulnerability enables attackers to impact resources beyond the vulnerable component's security scope, characteristic of XSS attacks that can compromise administrative sessions and pivot to broader system access.
Know when Ci4ms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.
Executive ViewAI
CI4MS versions prior to 0.31.0.0 contain a stored cross-site scripting vulnerability in user management that allows low-privilege authenticated users to inject malicious code targeting administrators, creating a direct pathway to administrative account compromise and full system control. This represents a critical risk to organizations using affected CI4MS deployments, as any staff member with basic system access can escalate to complete administrative control without detection.
No vendor-released patch identified at time of analysis. Interim mitigation: immediately restrict low-privilege user access to CI4MS user management interfaces using network access controls or application-level role restrictions; enable detailed logging and real-time alerting on user management page access and modifications; implement session monitoring for administrator accounts; consider air-gapping or isolating affected CI4MS instances until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Stored cross-site scripting in CI4MS before 0.31.2.0 allows an authenticated user with System Settings → Company Informa
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Stored cross-site scripting in CI4MS before 0.31.0.0 lets an authenticated user with blog create/edit rights save JavaSc
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Exploit-DB